Getting Data In

Splunk admin credentials in scripted input

Erik_Swan
Splunk Employee
Splunk Employee

I remember reading somewhere i could do this but cannot find any docs on it.

I have a scripted input that wants to perform a search to find out where it last left off. To perform the search i need to auth. I remember hearing that before my script was called splunk would set the env var $USER, $PASSWORD or something. I tried dumping out env but dont see it.

Anyone figured this out or am i just dreaming of a feature.

e

Tags (2)

Erik_Swan
Splunk Employee
Splunk Employee

gkanapathy
Splunk Employee
Splunk Employee

Well, that's for a search script, not a scripted input, so it's going to be slightly different. You could probably just read the first line of stdin with with scripted and get the token that way.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Perhaps what you're thinking of is that a scripted inputs and search scripts can receive an auth token. If they are set to do so (in commands.conf and inputs.conf respectively) the auth token should be passed in on stdin.

Erik_Swan
Splunk Employee
Splunk Employee

example somewhere?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Long before a new capability reaches the keynote stage, it begins as an idea waiting to be tested. At ...

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology ...

Data Management Digest – August 2026

Data Management Digest   Welcome to the August 2026 edition of Data Management Digest! August was a big month ...